[PATCH v11 14/74] drm/bridge: Fix unlocked list access in drm_bridge_attach()

[Luca Ceresoli]

On Mon Sep 21, 2026 at 9:23 AM CEST, Luca Ceresoli wrote:
> On Tue Sep 1, 2026 at 8:50 PM CEST, Cristian Ciocaltea wrote:
>> drm_bridge_attach() inspects bridge->list to warn about bridges being
>> attached without a previous drm_bridge_add() call, but it does so
>> without holding bridge_lock.
>>
>> The list head can be concurrently written by drm_bridge_add(),
>> drm_bridge_remove() and __drm_bridge_free() while they operate on
>> neighbouring entries of bridge_list or bridge_lingering_list, all of
>> them under bridge_lock.  Hence the unlocked read is a data race, even
>> though it is unlikely to change the outcome of list_empty() in practice.
>>
>> Perform the check with bridge_lock held.
>>
>> Fixes: 76f1a9711b83 ("drm/bridge: add warning for bridges attached without being added")
>> Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea at collabora.com>
>
> Reviewed-by: Luca Ceresoli <luca.ceresoli at bootlin.com>

And tested with bridge hotplug:
Tested-by: Luca Ceresoli <luca.ceresoli at bootlin.com>

--
Luca Ceresoli, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com